Using multiple clients with Authentik

[EddieDS]

Hi,

I’m trying to use OpenCloud with Authentik as external OIDC provider for multiple clients: web, desktop and Android.

What I have found so far is:

• Web login can be made to work with Authentik.
• Desktop and mobile become problematic because OpenCloud uses different predefined client IDs per client, while Authentik uses a different issuer/discovery per OIDC provider.
• If I configure separate providers in Authentik, the issuer mismatch becomes a problem.
• If I try to unify things around one provider/client setup, I run into client ID / redirect URI issues depending on the client.

I’ve already read discussions like #1014 and #1771, but I’m still unclear on the current supported path.

Is there currently an officially supported or recommended way to use OpenCloud with Authentik for multiple clients at the same time (web + desktop + Android), without relying on custom webfinger/proxy workarounds (which are above what I currently have the knowledge to handle) or reduced token verification?

Could you point me to the recommended setup? Or is multi-client Authentik support still considered a limitation at the moment?

Thanks in advance!

[rhafer]

Since v5.2.0 (this PR #2072) the OpenCloud server is able to provide some OIDC configuration parameters via webfinger to the clients.

By setting the env vars: WEBFINGER_ANDROID_OIDC_CLIENT_ID, WEBFINGER_DESKTOP_OIDC_CLIENT_ID, WEBFINGER_IOS_OIDC_CLIENT_ID, WEBFINGER_WEB_OIDC_CLIENT_ID you can configure the client id that each client should request. There is also OC_OIDC_CLIENT_ID if you want all clients to use the same id.

Also there are: WEBFINGER_ANDROID_OIDC_CLIENT_SCOPES, WEBFINGER_DESKTOP_OIDC_CLIENT_SCOPES, WEBFINGER_IOS_OIDC_CLIENT_SCOPES, WEBFINGER_WEB_OIDC_CLIENT_SCOPES to configure the list of scopes each client should request.

Please note that only Android, IOS and Web currently support reading these option for webfinger. The support for the desktop application is still work in progress.

For Authentik I was pretty much successful by using a single provider/client_id for all the available clients. And adjust the scopes for Android, IOS (and desktop for when the implementation lands) to include offline_access using the above mentioned variables. In Authentik itself you just need to setup a single application, make sure that it allows all the different redirect URI for the different clients mentioned here: https://docs.opencloud.eu/docs/admin/configuration/authentication-and-user-management/external-idp#client-configuration and all required scopes.